WiSec 2011 poster : context-adaptive entropy analysis as a lightweight detector of zero-day shellcode on mobiles

Abstract

Recent news about various attack vectors document how exploitation techniques are rapidly evolving into the mobile realm. New approaches for detecting attack traces in network traffic are needed for handheld devices that commonly own limited resources, but multiple, heterogeneous network interfaces. In this poster, we report on early results for statistical traffic analysis based on the Shannon Entropy. Unlike previous work, our time-frequency analysis extracts the non-stationary properties of entropy signals. From this context-adaptive technique, we obtain a clear signature of binary instructions and can also detect embedded shellcode.